[PATCH] drm: bridge: anx7625: don't crash if Type-C port is not used

[PATCH] drm: bridge: anx7625: don't crash if Type-C port is not used

[Dmitry Baryshkov]

From: Loic Poulain <loic.poulain@oss.qualcomm.com>

The typec_set_*() functions do not tolerate being passed the NULL
typec_port instance. However, if CONFIG_TYPEC is enabled, but anx7625
DT node doesn't have the usb-c connector fwnode, then typec_port remains
NULL, crashing the kernel. Prevent calling typec_set_foo() functions by
checking that ctx->typec_port is not NULL in anx7625_typec_set_status().

 Call trace:
  typec_set_orientation+0x18/0x68 (P)
  anx7625_typec_set_status+0x108/0x13c
  anx7625_work_func+0x124/0x438
  process_one_work+0x214/0x648
  worker_thread+0x1b4/0x358
  kthread+0x14c/0x214
  ret_from_fork+0x10/0x20
 Code: 910003fd a90153f3 aa0003f3 2a0103f4 (f9431400)

Fixes: f81455b2d332 ("drm: bridge: anx7625: implement minimal Type-C support")
Reported-by: Salendarsingh Gaud <sgaud@qti.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
[db: dropped chunk anx7625_typec_unregister(), wrote commit message]
Cc: Amit Kucheria <akucheri@qti.qualcomm.com>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
---
 drivers/gpu/drm/bridge/analogix/anx7625.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/bridge/analogix/anx7625.c b/drivers/gpu/drm/bridge/analogix/anx7625.c
index c43519097a45..7f943b6548f3 100644
--- a/drivers/gpu/drm/bridge/analogix/anx7625.c
+++ b/drivers/gpu/drm/bridge/analogix/anx7625.c
@@ -1567,6 +1567,9 @@ static void anx7625_typec_set_status(struct anx7625_data *ctx,
 				     unsigned int intr_status,
 				     unsigned int intr_vector)
 {
+	if (!ctx->typec_port)
+		return;
+
 	if (intr_vector & CC_STATUS)
 		anx7625_typec_set_orientation(ctx);
 	if (intr_vector & DATA_ROLE_STATUS) {

---
base-commit: 400a84e1f7a3681ef24d58d49b5d07e81c14f4e9
change-id: 20260215-anx-fix-no-typec-4437cb7e54d2

Best regards,
-- 
With best wishes
Dmitry

Claude review: drm: bridge: anx7625: don't crash if Type-C port is not used

[Claude Code Review Bot]

Overall Series Review

Subject: drm: bridge: anx7625: don't crash if Type-C port is not used
Author: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patches: 1
Reviewed: 2026-02-15T19:02:41.103070

---

This is a single-patch fix for a NULL pointer dereference crash in the anx7625 DRM bridge driver's Type-C support code. The crash occurs when CONFIG_TYPEC is enabled but the anx7625 device tree node does not include a USB-C connector fwnode, leaving `ctx->typec_port` as NULL. The `typec_set_*()` family of functions do not handle NULL port arguments, so calling them unconditionally causes a kernel crash.

The fix is minimal and appropriate: a NULL check on `ctx->typec_port` at the top of `anx7625_typec_set_status()`, which is the single chokepoint through which all typec state updates flow. The commit message includes the actual crash trace, a clear Fixes: tag, and proper attribution. The approach is correct — guarding at the entry point rather than at each individual `typec_set_*()` call site keeps the fix simple and complete.

One minor observation: the original submitter's changelog mentioned a dropped chunk for `anx7625_typec_unregister()`. Since `typec_unregister_port()` also does not tolerate NULL, that path could have a similar issue if the unregister path is reached without a typec port having been registered. However, the note "[db: dropped chunk anx7625_typec_unregister()]" suggests this was considered and determined unnecessary — likely because `typec_unregister_port(NULL)` is either already guarded or the unregister path isn't reachable without a successful registration. Without the tree containing this code I cannot verify, but it's worth the author confirming.

---
Generated by Claude Code Patch Reviewer

Claude review: drm: bridge: anx7625: don't crash if Type-C port is not used

[Claude Code Review Bot]

Patch Review

> +	if (!ctx->typec_port)
> +		return;
> +
>  	if (intr_vector & CC_STATUS)
>  		anx7625_typec_set_orientation(ctx);
>  	if (intr_vector & DATA_ROLE_STATUS) {

The fix is correct and well-placed. `anx7625_typec_set_status()` is the function that dispatches to `anx7625_typec_set_orientation()` and the data/power role status paths, all of which ultimately call `typec_set_*()` functions that will dereference the port pointer. Guarding at this single entry point covers all downstream call sites.

One question: the changelog notes that a chunk fixing `anx7625_typec_unregister()` was dropped. Does `anx7625_typec_unregister()` also need a NULL guard on `ctx->typec_port` before calling `typec_unregister_port()`? If the driver's remove/unbind path can be reached without the typec port having been successfully registered (e.g., probe succeeded but typec registration was skipped because the connector fwnode was absent), then the same NULL dereference would occur on driver removal. It would be worth confirming that the unregister path is already safe.

Otherwise, no issues found. The fix is minimal, targeted, has the correct Fixes: tag, and the commit message clearly explains the problem with an actual crash trace.

---
Generated by Claude Code Patch Reviewer